name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  quality:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v6
      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true
      - name: Check formatting
        run: |
          files="$(gofmt -l .)"
          if [ -n "$files" ]; then
            echo "Unformatted Go files:"
            echo "$files"
            exit 1
          fi
      - name: Check module files
        run: go mod tidy && git diff --exit-code
      - name: Validate Agent Skill package
        run: python3 scripts/validate_skill.py .
      - name: Static analysis
        run: go run honnef.co/go/tools/cmd/staticcheck@v0.7.0 ./...
      - name: Vulnerability scan
        run: go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...

  test:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Check out repository
        uses: actions/checkout@v6
      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true
      - name: Resolve modules
        run: go mod download
      - name: Test with race detector
        run: go test -race ./...
      - name: DNSCrypt interoperability
        if: matrix.os == 'ubuntu-latest'
        env:
          EDNSDIAG_DNSCRYPT_INTEROP: "1"
        run: go test ./internal/edns -run '^TestDNSCryptAdGuardInteroperability$' -count=1
      - name: Public DoH and DoT interoperability
        if: matrix.os == 'ubuntu-latest'
        env:
          EDNSDIAG_PUBLIC_INTEROP: "1"
        run: go test ./internal/edns -run '^TestPublicCloudflareDo[HT]Interoperability$' -count=1 -v
      - name: Vet
        run: go vet ./...